10 things disney can teach us about running a security awareness program (download to have gifs...

10 THINGS DISNEY CAN TEACH US ABOUT RUNNING A

Ashley Schwartau • @AshleySchwartauCreative Director, The Security Awareness Company • @SecAwareCo

TheSecurityAwarenessCompany.com

Creative Director for 6 yearsWorking for SAC for 14 yearsLead developer of all training materialsWorked with over 80 companies75 employees – 75,000 employees

Disney taught me a lot growing upFun, fresh way of presenting same old topics can lead to better retentionInline with our company philosophy of having fun with security awareness

TALE AS OLD AS TIMEEver just the same

Ever a surpriseEver as before

Ever just as sureAs the sun will riseTale as old as time

Don’t reinvent the wheel.

TALE AS OLD AS TIME

Has security changed at all?Common sense (look in the Trojan horse before accepting it)Avoid scams (snake oil salesmen)Protect confidential information (loose lips sink ships)

Forget about the tech.

TALE AS OLD AS TIME

Focus on foundations.

TALE AS OLD AS TIME

Learn to dance.Security Triads.Improve your vocabulary.

HONOR TO US ALLScarier than the undertaker

We are meeting our matchmakerDestiny

Guard our girlsAnd our future

as it fast unfurlsPlease look kindly onthese cultured pearls

Each a perfect porcelain doll

Please bring honor to us

WHY educate users? Why is this program necessary?

HONOR TO US ALL

Understanding WHY helps everyone:Bring honor to your organization.

HONOR TO US ALL

THE WORK SONG

Cinderelly, CinderellyNight and day it's CinderellyMake the fire, fix the breakfastWash the dishes, do the moppingAnd the sweeping and the dustingThey always keep her hopping She goes around in circlesTill she's very, very dizzyStill they holler

Keep a-busy Cinderelly!We can do it, we can do it

We can help our CinderellyWe can make her dress so pretty

There's nothing to it, reallyWe'll tie a sash around it

Put a ribbon through itWhen dancing at the ball

She'll be more beautiful than allIn the lovely dress we'll make for Cinderelly

THE WORK SONG

Remember: Cinderella didn’t do it alone. And neither can you.

THE WORK SONG

Get people to help you.

Interns?Minions?Assistants? Like-minded co-workers?Someone to help spread the word.Someone to help DO THE WORK.

You need mice.

THE WORK SONG

Get people to help you.

C-level support is key!MoneyMoraleMotivation

And a Fairy Godmother.

ONE JUMP AHEAD

One jump ahead of the lawmenThat's all, and that's no joke

These guys don't appreciate I'm broke

ONE JUMP AHEAD

Gotta keep one jump ahead of the…

Reactive vs. PreventativeNot just current problems. Look ahead.

PROBLEMS.

ONE JUMP AHEAD

Gotta keep one jump ahead of the…

Big picture: What do you NEED?Money? Team members? Content?Plan a whole year in advance.

BUDGET.

GO THE DISTANCE

GO THE DISTANCE

Don’t half-ass it.

Commit to educating your users.

Commit to regularity and frequency Commit to changing culture.

GO THE DISTANCE

Why run a marathon if you’re not going to train for it?

Plan ahead.Think about your needs.Help yourself reach the finish line.

GO THE DISTANCE

It’s not going to be easy.

(But neither were the 12 labors of Hercules.)

LES POISSONS, LES POISSONS

Les poissons, les poissonsHow I love les poissons

Love to chop and to serve little fishFirst I cut off their heads

Then I pull out their bonesAh mais oui, ca c'est toujours délice

Your diet should consist of more than just Phish.

Human error. Having (and enforcing) policies.Not knowing what PII is.Using personal devices for company information.Public WiFiPasswords

LES POISSONS, LES POISSONS

Use phishing as a launching point.

Vishing and SmishingTypes of MalwareEmail managementSocial Media ScamsSocial Engineering

LES POISSONS, LES POISSONS

Incorporate phishing/soc eng into other lessons.Cyber: holiday scams, strong unique logins, don’t share TMI, ID theft.

Physical: shredding policies, dumpster diving, USB sticks.

Human: con artists, pretexting & other phone scams, pentesting.

LES POISSONS, LES POISSONS

YOU CAN FLY

When there's a smile in your heartThere's no better time to startThink of all the joy you'll findWhen you leave t he world behindAnd bid your cares good-byeYou can fly! You can fly! You can fly!

YOU CAN FLY

Make your users care by making it about them.

Why should I pay attention to this training?How does this affect ME?I care about: protecting my money, protecting my health data, protecting my kids and family, etc.Teach me how to protect ME and I’ll listen.

YOU CAN FLY

Empower your users through education.Educated users make educated decisions.Educated users make better human firewalls.Human firewalls build your front lines of defense.

YOU CAN FLY

Give them the pixie dust of security awareness.

A SPOONFUL OF SUGAR

In every job that must be doneThere is an element of funYou find the fun and SNAP

The job’s a game.

A SPOONFUL OF SUGAR

How did Mary Poppins get those kids to obey her?Use humor!Sing a song!Short videos!Realistic scenarios.Gamify your training!Contests & Prizes!

A SPOONFUL OF SUGAR

Be a modern day Mary Poppins.

LET IT GO

It's funny how some distanceMakes everything seem smallAnd the fears that once controlled meCan't get to me at all!

It's time to see what I can doTo test the limits and break throughNo right, no wrong, no rules for me I'm free!

LET IT GO

Be prepared to let go of…. PRECONCEPTIONS.

Not every user is the problem.Not all training works for all people.Don’t assume they won’t listen.

LET IT GO

Be prepared to let go of…. EXPECTATIONS.Not an overnight solution. Long game. Won’t be 100% effective.

LET IT GO

Be prepared to let go of….STUFF THAT’S NOT WORKING.

The past is in the past. What problem is most important NOW?Reassess & reevaluate throughout the year.

LET IT GO

Be bold, strong and daring like Elsa.

CIRCLE OF LIFE

CIRCLE OF LIFE

Security Awareness is a delicate balance.

Confidentiality, Integrity, AvailabilityCyber, Physical, HumanPersonal, Professional, MobilePeople, Policies, TechnologyC-Levels, Tech Staff, Users

CIRCLE OF LIFE

Security Awareness is not an end goal.

Not something we “achieve”Not a one time thing.Like exercise, eating healthy, learning to drive, etc.Like advertising: they don’t want you to buy it ONCE but over and over again.

CIRCLE OF LIFE

Security Awareness is a mindset and a way of life.

Tale As Old As TimeHonor to Us AllThe Work Song

One Jump AheadGo the Distance

Les Poissons, Les PoissonsYou Can Fly

A Spoonful of SugarLet It Go

Circle of Life

to help you whistle while you work

@SecAwareCo • #SecurityCatFree.TheSecurityAwarenessCompany.comBlog.TheSecurityAwarenessCompany.com

Questions?CONTACT ME! @AshleySchwartauAshley@TheSecurityAwarenessCompany.com

linkedin.com/in/ashleyschwartau